How Open-Source Companies Actually Make Money

Layla LevesqueOctober 7, 20267 Mins read1

How Open-Source Companies Actually Make Money

Photo: W65C816S Machine Code Monitor by BigDumbDinosaur, representing BCS Technology Limited via Wikimedia Commons, CC BY-SA 3.0

In February 2025, IBM closed its $6.4 billion acquisition of HashiCorp, the company behind Terraform and Vault. Eighteen months earlier, HashiCorp had stopped releasing its flagship products under an open-source licence. Developers were furious. A rival project forked Terraform within weeks. And yet the business still sold for $35 a share in cash to one of the oldest names in computing.

That sequence tells you most of what you need to know about making money from open source. The code is free, the value is real, and the tension between those two facts never quite goes away. Every company in this space is trying to answer the same question: if anyone can download your product, what exactly are customers paying for?

The answers have changed a lot over three decades. Here is how the main models work, who has made them work, and why the licensing fights of the last few years matter to anyone building a startup on open code.

Model one: sell the support, not the software

Red Hat is the original proof that a company can give its product away and still get rich. Its business was never about selling Linux. It sold subscriptions that bundled certified, tested releases with patches, security updates and someone to call when a server fell over at 3 a.m.

The model worked spectacularly. In fiscal 2012, Red Hat reported revenue of $1.13 billion, and then-CEO Jim Whitehurst described it as the first pure-play open-source company to pass the billion-dollar mark. Subscriptions made up about 85% of that revenue. Seven years later, IBM bought the company for about $34 billion, closing the deal in July 2019.

The support model has a weakness, though. If the code is truly open, someone else can rebuild it and offer it for free. For years, CentOS did exactly that with Red Hat Enterprise Linux. In June 2023, Red Hat stopped publishing RHEL source code openly and limited public releases to CentOS Stream, The Register reported, which made life much harder for rebuild projects like Rocky Linux and AlmaLinux. Red Hat framed it as a focus on Stream. Critics saw a company protecting its moat. Both readings can be true.

Model two: open core

Open core is the most common model among venture-backed open-source startups. The basic product is open source. Features that large organizations need, such as advanced security, audit logs, single sign-on and compliance reporting, live in a paid edition.

GitLab is the textbook example, and it’s unusually candid about how it decides what to charge for. Co-founder Sid Sijbrandij has described a “buyer-based” approach: features aimed at individual contributors are open source, while features that managers, directors and executives care about go into progressively more expensive tiers, as the company explained in a 2018 post. A developer gets everything needed to write and ship code. The head of security pays for the dashboard.

It works. GitLab reported fiscal 2026 revenue of $955.2 million, up 26%, with 1,456 customers paying more than $100,000 a year.

The hard part of open core is the line itself. Put too much in the free edition and nobody pays. Put too little and the community drifts to a competitor or a fork. In practice, that line is a permanent negotiation rather than a one-time decision, and it shifts as competitors and customer expectations change.

Model three: run it for them

The most successful model of the last decade is also the simplest to explain. Most companies don’t want to operate a database or search cluster themselves. They want someone else to handle backups, scaling, upgrades and uptime. So open-source companies sell a managed cloud service.

MongoDB shows how far this can go. Its Atlas cloud service made up about 76% of subscription revenue in fiscal 2026, bringing in $1.81 billion of the company’s $2.46 billion total, according to its March 2026 results. Atlas grew 29% year over year and had more than 63,900 customers.

There’s a Canadian example of a hybrid approach in Toronto-based Tailscale. Its client software is open source, but the coordination server that runs its managed network is closed, the company says. It even supports Headscale, a community-built open-source alternative to that server, for people who want to host everything themselves. In April 2025 Tailscale raised a US$160 million Series C at a US$1.45 billion valuation, BetaKit reported.

The catch: someone bigger can host it too

The hosting model has an obvious vulnerability. If your code is under a permissive licence, Amazon, Google or Microsoft can offer it as a managed service on their own clouds, with their own billing relationships and sales teams. That’s legal. It’s also, from the original company’s point of view, a nightmare. This single problem is behind almost every major licensing fight of the past eight years.

The licence wars

Starting in 2018, a string of well-known companies moved away from traditional open-source licences to “source-available” terms that block cloud providers from offering competing services. Here’s a short timeline of the big ones:

Company	Change	When	What happened next
MongoDB	AGPL to SSPL	October 2018	Stayed on SSPL; cloud business boomed
Elastic	Apache 2.0 to SSPL and Elastic License	2021	AWS forked it as OpenSearch; AGPL option added in 2024
HashiCorp	MPL 2.0 to Business Source License	August 2023	OpenTofu fork; acquired by IBM in 2025
Redis	BSD to RSAL and SSPL	March 2024	Valkey fork; AGPL option added with Redis 8 in 2025

MongoDB wrote the playbook. Its Server Side Public License, announced in October 2018, requires anyone offering the software as a service to open-source the code they use to run that service, or buy a commercial licence. The company argued that cloud vendors were capturing the value while contributing little back.

The Open Source Initiative, which maintains the official definition of open source, disagreed sharply. In a 2021 statement, its board said the SSPL fails the definition because it discriminates against a field of endeavour, and called marketing SSPL software as open source “deception, plain and simple.”

HashiCorp and the OpenTofu fork

HashiCorp’s August 2023 switch to the Business Source License allowed most users to keep using Terraform for free, but barred vendors from building competing products on future releases. The company pointed out that Couchbase, Cockroach Labs and others had made similar moves.

The response was fast. A group of infrastructure companies, including Gruntwork, Spacelift, env0, Scalr and Harness, forked the last open version and, in September 2023, the project joined the Linux Foundation as OpenTofu with backing from more than 140 organizations. Then IBM, already Red Hat’s parent, announced the HashiCorp deal in April 2024 and completed it in February 2025 after U.S. and U.K. regulatory reviews. IBM’s pitch was about pairing Terraform with Red Hat’s Ansible automation, not about licences.

Elastic and Redis come back, sort of

The most interesting twist is that two of the companies that left open source have partly returned. In August 2024, Elastic founder Shay Banon announced that Elasticsearch and Kibana would be available under the AGPL, an OSI-approved licence, alongside the existing options, InfoQ reported. His reasoning was that the open-source label removes doubt for users.

Redis followed in 2025. Its March 2024 move away from the BSD licence had triggered the Valkey fork, backed by AWS, Google, Oracle and others. With Redis 8, the company added AGPL as an option, and original creator Salvatore Sanfilippo returned to the project. CEO Rowan Trollope acknowledged the OSI was never going to approve the SSPL, The Register reported.

Why AGPL? It’s a real open-source licence, but it has teeth. Anyone who modifies AGPL software and offers it over a network must share their changes. Big cloud providers generally avoid it, which gives the original company much of the protection it wanted without the reputational cost of leaving open source.

What the licence fights actually taught us

Looking back, a few lessons seem fairly clear:

Forks are a credible threat. OpenSearch, OpenTofu and Valkey all attracted serious corporate backing. When a project is critical infrastructure, the community and the cloud providers can and will carry on without you.
Licence changes don’t kill businesses. MongoDB kept growing after its switch, and HashiCorp still found a buyer at a healthy price. Customers paying for a managed service are mostly buying convenience, not a licence.
Trust is the real cost. Developers remember. When Redis returned to an open licence, InfoQ noted that many practitioners still felt the damage to trust could not be fully repaired.
Contributor agreements matter. Companies could relicense because they held copyright over contributions. Projects run by foundations can’t be relicensed that way, which is part of why forks land there.

Advice for founders building on open source

If you’re starting an open-source company in Canada or anywhere else, the most useful thing you can do is decide on your business model before you choose a licence, not after. Changing licences five years in is possible, as these examples show, but it’s expensive in ways that don’t show up on a balance sheet.

A few practical questions to work through early:

Who pays, and for what? Individual developers rarely pay. Their bosses’ bosses do, for security, compliance, reliability and convenience.
Can you run it better than anyone else? A managed service is now the default way to earn revenue, and it’s hard for a cloud giant to beat the people who wrote the code on depth of expertise.
Is a copyleft licence like AGPL a better fit than a permissive one? It can discourage free-riding without leaving the open-source tent.
What happens to contributors’ rights? Contributor licence agreements are a legal decision with community consequences, so get proper legal advice before you set one up.

Our view is that the industry has settled into a rough equilibrium. Open source gets you adoption. A managed cloud product or carefully drawn enterprise tier gets you revenue. And the licence should be chosen for the long haul, because the HashiCorp and Redis stories show that the community will hold you to whatever promise it thinks you made on day one.